Gate the workspace manifest dependency graph against cycles (#14524)

* feat(scripts): gate the workspace manifest graph against cycles (#13513)

Adds check:workspace-manifest-cycles, a new check family that walks every
workspace: edge in dependencies, devDependencies, peerDependencies and
optionalDependencies across all 78 workspace packages and refuses on any
cycle, naming each edge with its declaration class. peerDependencies is
walked deliberately: a scan omitting it reports 0 cycles on the pre-fix
#13513 tree, honestly and wrongly, since that cycle's first edge was a
peer edge. Wired into lint.yml next to check:turbo-task-graph, the
repo's existing collector idiom for this kind of manifest sweep.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

* fix(pm): classify check-workspace-manifest-cycles.mjs::runSelfTest in COMPOUND_ANCHOR_LEDGER

The self-test declaration this PR adds in
scripts/check-workspace-manifest-cycles.mjs (runSelfTest) is a compound
name the anchor matches, and the pm-dispatch-gates census requires every
such name be classified. It is a genuine self-test battery, so
accidental: false, placed in file-path order among the other
scripts/check-*.mjs accidental:false rows.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -3631,6 +3631,39 @@ jobs:
       - name: turbo.json package tasks name real packages and real scripts
         run: pnpm check:turbo-task-graph
 
+      # The workspace manifest graph, over every `workspace:` edge in
+      # `dependencies`, `devDependencies`, `peerDependencies` and
+      # `optionalDependencies` across all workspace packages, has NO cycle
+      # (#13513, filed as #14195).
+      #
+      # #13513 cost seven independent dev seats a wasted build cycle each, on
+      # trees they did not touch, because one `devDependencies` edge made the
+      # graph cyclic. A cyclic edge does not fail where it is added -- the
+      # author's own package builds fine -- it fails later, in SOMEONE ELSE's
+      # closure build, in a package they did not touch, non-deterministically
+      # (which member loses the DTS race is a scheduling outcome). Before this
+      # gate the only signal was `pnpm install` printing `WARN There are
+      # cyclic workspace dependencies: …` on stderr with EXIT 0, and it had
+      # been printing that warning for the entire life of the #13513 defect
+      # before anyone read it.
+      #
+      # All FOUR declaration classes are walked, `peerDependencies` included:
+      # a scan over the other three alone reports 0 cycles on the pre-fix
+      # #13513 tree, honestly and wrongly -- the loop's first edge was a
+      # `peerDependencies` edge (#13513 comment `5473800149`, resolved in
+      # `5479206575`). Every cycle is named with the declaration class of each
+      # edge that closes it (`A --devDependencies--> B`), because "there is a
+      # cycle" does not tell an author which edge to cut.
+      #
+      # Reads the workspace manifests only (via the shared enumerator). No
+      # build, no pnpm invocation, no network, sub-second. The `check:` key
+      # runs `--self-test` first: this gate's defect class is its matching
+      # rule, which a clean tree cannot distinguish from a rule that stopped
+      # matching, and the peer-only / optional-only cases are the #13513
+      # false-zero control -- a walker that drops either class fails them.
+      - name: workspace manifest dependency graph has no cycle
+        run: pnpm check:workspace-manifest-cycles
+
       # A relationship carrier is spelled as the target object's NAME (#13103).
       # `FieldSchema.reference` is `z.string()`, and #13053 measured what a
       # non-string one costs: a fixture spelling `reference: { object: '...' }`

package.json

@@ -80,6 +80,7 @@
     "check:single-claim-paths": "node scripts/check-single-claim-paths.mjs --self-test",
     "check:pnpm-filter-targets": "node scripts/pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs",
     "check:turbo-task-graph": "node scripts/check-turbo-task-graph.mjs --self-test && node scripts/check-turbo-task-graph.mjs",
+    "check:workspace-manifest-cycles": "node scripts/check-workspace-manifest-cycles.mjs --self-test && node scripts/check-workspace-manifest-cycles.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",